QSI_HistorySession is listed as a "user survey" cookie on the danish version.

mbox is probably Site Catalyst: http://cookiepedia.co.uk/cooki...

Anyway, A danish customer checked it and found out that session related cookies to the homebanking solution (which is hosted elsewhere) is called NSSID. https://twitter.com/kimtiede/s...

The researcher didn't actually test if he could hijack a session.

If he had tried he would see that the cookies in question are not authentication cookies used by the bank. The cookies in question are described as 'statistical' cookies on http://www.danskebank.com/en-u...

I'm really amazed about the publicity one single blogger can get with such undocumented claims.